7 ms·
GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years
UAF = Use After Free (https://en.wikipedia.org/wiki/Dangling_pointer https://en.wikipedia.org/wiki/Dangling_pointer)
- mixmastamyk 3mo agoA what?
- didntcheck 3mo agoUnidentified Aerial Fenomenom
- happymellon 3mo agoUse after free?
- teo_zero 3mo agoI'm glad someone else asked. :) It's not so widely used and it's not explained in the first couple screenfuls of TFA (which by itself is weirdly structured, taking entire paragraphs to explain when it was introduced, when it was discovered, etc. before even explaining what it actually is). Of course the title was chosen when the article was first published on a site dedicated to security, where probably everyone knows it. This suggests that insisting on unmodified titles when republishing in HN is a poor rule.
- lkirkwood 3mo agoNot that everyone should know it but it's definitely widely used. A Google search for "stack UAF" also turns it up.
- teleforce 3mo ago>Google has rewarded us $92,337 in kernelCTF I'm all ears now
- mrbluecoat 3mo agoSeems low considering the wide impact, but maybe the only thing corporations throw big money at is remote exploits?
- tptacek 3mo agoThat's a huge amount of money for a vulnerability.
- esseph 3mo agohttps://www.forbes.com/sites/daveywinder/2026/05/05/google-to-pay-15-million-for-pixel-phone-security-exploit/ https://www.forbes.com/sites/daveywinder/2026/05/05/google-t...
- inigyou 3mo agoAlso one order of magnitude less than you could get on the black market for a universal Linux LPE and two orders less if you can make it work reliably.
- tptacek 3mo agoI believe you are two orders of magnitude wrong, in the upward direction, on that number (the first of them). You're talking about reliable remote numbers there, full chain, full enablement, tranched with maintenance.
- inigyou 3mo agoSurely working on Android adjusts the number upwards by a lot?
- deleted 3mo ago
- password4321 3mo agoForgot to include "LPE" (local...) in the title so most of us can get back to weekending.
- circularfoyers 3mo agoSince this enables container escape, sounds like this might still impact quite a lot of us?
- hollerith 3mo agoA lot of us rely on Linux containers' being escape-proof? I would have hoped that only a few of us are so misinformed as to do that.
- password4321 3mo agoI guess, if you thought Docker/etc. was a security boundary
- markasoftware 3mo agoRunpod, digital ocean's gpu cloud, and at least a few others use Linux containers for isolation between tenants (look at Wiz's blog post about the nvidia container toolkit bug; digitalocean just puts everyone in a massive k8s cluster)
- stingraycharles 3mo agoWhy aren’t they using a fast VM like Firecracker?
- himata4113 3mo agoTo squeeze out 5% more profit.
- circularfoyers 3mo agoI know there's a lot you can do in k8s to mitigate it, but I didn't think that prevented it outright.
- amatecha 3mo agoDaaaaamn: "GhostLock was introduced in Linux 2.6.39 and fixed in Linux 7.1."
- Curtis_Guan 3mo ago[flagged]
- goodburb 3mo agoTested on three Android devices (version 9, 13, 16) with different Firefox versions under 150 (had to modify for older). Two boot looped, I had to enter recovery and the other just powered off [0]. The demo modifies the wallpaper on supported Pixel devices. [0] IonStack https://rootme.nebusec.ai https://rootme.nebusec.ai ____ Tip: Install a Chromium flavor browser (Chromite) separate from the main browser. Disable Javascript and hardware accelerated video decoder (commonly exploited) from the flags page and enable reader mode to fix broken JS-dependent websites when browsing blogs and random sites on your personal devices, else dedicate a tablet.
- Chu4eeno 3mo agofwiw, the firefox vulnerability seems to be CVE-2026-10702 (type confusion in the ionmonkey jit compiler): https://www.sentinelone.com/vulnerability-database/cve-2026-10702/ https://www.sentinelone.com/vulnerability-database/cve-2026-...
- no_time 3mo agoSeverity score of 4.3 seems low considering the click2pwn in this thread. Though Firefox on Android is uniquely bad because of the lack of sandboxing.
- etenal 3mo agoThanks for testing, we currently only tested it on Pixel 10, but there are a few people on our repo creating PR to support other devices, you can take a look here https://github.com/NebuSec/CyberMeowfia https://github.com/NebuSec/CyberMeowfia
- bana-io 3mo agoCan you please provide a `Dockerfile` to build the POC/exploit?
- Retr0id 3mo agoI've been noodling with porting the kernel exploit to other devices, and the exploit is very sensitive to how the compiler happens to lay out stack frames, which varies between kernel builds. Once you figure out the right "stamp method" and offsets for a particular kernel build though, it's fairly reliable.
- deleted 3mo ago[deleted]
- Uptrenda 3mo agoHas anyone in infosec ever seen the term "use after free" before LLMs? Or is this basically an acronym claude invented? I say this because I see claude use this term all the time like its common knowledge but in 15+ years in tech never seen it myself. I've seen all kinds of terms used to describe memory errors: memory corruption, heap corruption, stack corruption, whatever, just never this acronym.
- abofh 3mo ago[flagged]
- Uptrenda 3mo ago[flagged]
- abofh 3mo ago[flagged]
- Uptrenda 3mo ago[flagged]
- dang 3mo agoHey guys - please don't do tit for tat spats on HN. I know how it feels (believe me, I know how it feels down to such a level that any hypothetical offspring would also know how it feels), but it only makes everything worse. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- dang 3mo agoHey guys - please don't do tit for tat spats on HN. I know how it feels (believe me, I know how it feels down to such a level that any hypothetical offspring would also know how it feels), but it only makes everything worse. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- alexjplant 3mo ago> This is the same shape as many other life-cycle bugs [...] Claude-ism detected. IME with Claude Code an object does not have a type or definition, apparently, but rather a shape (or at least it reaches for that word before more technically-accurate ones). Problems are not of a similar class or type, but of the same shape. Functions are not defined by their signatures but by their shape. Who talks like this and how did it make its way into the training data so pervasively?
- dang 3mo agoI think you're probably right that the article was AI-assisted, but (if so) it's important not to confuse that with the thing the article is about. Google wouldn't pay $90k for a hallucination. I don't mean that as a criticism—the question of how to receive AI-processed content is chaotic right now. I'm working on a post about that here: https://news.ycombinator.com/item?id=48887149 https://news.ycombinator.com/item?id=48887149. Btw, Nebula Sec is a YC startup in the current batch. We've been working with them on how to launch on HN, and one of the things I've been trying to explain is that the HN audience won't respond well to LLM-generated reports. The underlying work, though, is impressive. These guys know what they're doing—the OP is by no means their only significant find—and the fact that they're doing it with an agent, rather than the traditional way, is significant.
- cwillu 3mo agoA thing that notably triggers my allergies is that if significant human effort went into something, a few paragraphs written by a human seems like a trivial additional investment; if that last touch is missing, it's really hard for me to extend the benefit of the doubt that there really is something there. Obviously this is only one signal among many, one that can be overruled, but the ick remains regardless.
- dang 3mo agoI agree to an extent, but there are many exceptions, so one can't really withhold the benefit of the doubt. For example, non-native English speakers (as is the case with these guys IIRC) frequently use these tools. Maybe they shouldn't—as I've been telling a lot of people who email, mistakes are rapidly becoming a sign of authenticity at this point—but the belief that they need to is widespread, and this doesn't mean they didn't do significant work. (Side note: it's a common assumption that machine-translated text is in a different category from LLM-edited text. From what we're seeing, that assumption is unfortunately wrong.) Another important case is people with disabilities who find these technologies assistive. Again, one can argue that they're increasingly better off just posting their own writing in the raw, but this is a pretty obscure point to get across to people, and in some cases it would impose a significant burden. Beyond those cases, a lot of people just don't write easily, and/or don't feel their writing is any good. A lot of them are using LLMs to compensate for that, and this by no means implies that their work is bad. Maybe they just have a phobia about writing and/or don't express themselves well that way. People who enjoy writing or are confident writers fail to understand how emotionally fraught writing is for many others. Personally I'm down with the "writing is thinking" view, from which it follows that bad writing is bad thinking. But it doesn't follow that "thinking is writing" - that's a much stronger claim, from which it would follow that good thinking is good writing—and this I think is false.
- KnockOutEZ 3mo agoDamn
- tangenter 3mo agoFuck it. I’m exclusively running the book version of minix from now on, neovim be damned. The exploit surface of these kernels is wild.
- KasianFranks 3mo agoSo has the church of the subgenius.
- 0xbadcafebee 3mo agoDo we really need infosec companies now that a skid with claude can find decades-old kernel privesc over a weekend? Also can we talk about how bad Linux security is? At this point it's becoming a real liability to run anything on Linux that needs to be secure. OpenBSD has been around for ages, is written in C, and is really, really secure. Do they support containers yet (or microVMs)? Cuz if they do, I'm moving my workloads to obsd.
- close04 3mo ago> Do we really need infosec companies now that a skid with claude can find decades-old kernel privesc over a weekend? Why are you not making easy money hand over fist from these rewards? A couple of weekends of work and you can retire early. Maybe that's exactly what these infosec companies are. And maybe you need more than "a skid with claude over a weekend" to get anything worthwhile.
- _def 3mo ago> and is really, really secure ... until its getting popular usage and gets targeted for vulnerability research
- titularcomment 3mo agoOpenBSD is the Linux of a decade or two ago, not attracting attention and not being compatible or useful for quite a lot of stuff.
- NexRebular 3mo agoNot counting GPU compute, what exactly is OpenBSD not useful for?
- titularcomment 3mo agoPersonal laptop use with Ada Lovelace or Ampere family NVIDIA GPUs (did you mean this or CUDA, i couldnt tell), personal desktop use with unusual peripherals, dependency on ports, existence and competition of FreeBSD etc. I love OpenBSD's code philosophy (they were the first to introduce a lot of security techniques[1]) and the programs they produce, OpenSSH is a lifesaver, and I use doas for its low footprint on my Linux machine. Still, they have a convulated install process, dubious hardware and software compatibility that is better solved in the Linux world today. [1]: https://www.openbsd.org/innovations.html https://www.openbsd.org/innovations.html
- 0x1ceb00da 3mo agoDoes that mean any android app can use ndk native code execution to become root? Does selinux help here?
- goodburb 3mo agoConsidering that it's rare to get kernel (or any) updates on non-flagship phones, it seems likely. Backporting an old kernel should be possible, but the only indicator is the system update changelog that explicitly mentions it, I rarely see CVEs mentioned in changelogs on any smartphone. A tool to test the vulnerability is the only way. Any compromised app on the Play store or external can get root access instantly, but we can still rely on trust and audits when installing apps which should always be the rule. I suspect that this will be added to all Google Play integrity levels, limiting many apps from being installed on unpatched phones in the future. That's not the case with browsers with random sites and ads which is hardly avoidable, having any sandbox escape is now more severe considering that it bypasses the app container. It's similar to JailbreakMe on iOS [0] [0] https://en.wikipedia.org/wiki/JailbreakMe https://en.wikipedia.org/wiki/JailbreakMe
- kuschku 3mo ago> I suspect that this will be added to all Google Play integrity levels, limiting many apps from being installed on unpatched phones in the future. You do realize that a full kernel vulnerability like this allows you to feed falsified information to SafetyNet? Just like DRM, it gives the developer the illusion of control, but doesn't do anything to actually improve "safety" or "integrity". It's silly that whenever I see a vulnerability like this, all I can think about is "finally, a way to get control over my own devices back". Once again, Stallman was right. https://www.gnu.org/philosophy/right-to-read.en.html https://www.gnu.org/philosophy/right-to-read.en.html Personally, I'll use this to root my Android TV and Chromecast devices and remove the shitty ads in the launcher (which Google added after I bought the devices!).
- goodburb 3mo agoAgreed, but I think this will force the average user to upgrade* their phones after losing access to sensitive apps (bank, gov) before getting compromised. Good news for reusing old phones and taking control. *as in replace
- poly2it 3mo agoIs HN bugged? I swear I have read these comments the day prior, there is no way they are from within 10 hours?
- tpetry 3mo agoSometimes similar articles are merged into one. Including the comments.
- dang 3mo agoI don't know what "bugged" means but what you're seeing is probably an artifact of HN's re-upping system. We re-upped this thread and that relativized the timestamps on the previously existing comments (https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20timestamps%20re-up&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...). Sorry for the confusion—I know it's weird but so far no one has come up with an alternative that is less confusing. The reason I re-upped this post, btw, is that it was at the top of a list called "underwater" that we try to look at every day, which lists the most-upvoted posts that for whatever reason didn't happen to make the frontpage. This was at the top of that list.
- poly2it 3mo agoAh, I didn't know actual post timestamps for comments are updated. That explains it, thank you!
- philipwhiuk 3mo agoNew 'lastSubmission' field for the post item. Show both if they're different. Then just update lastSubmission on re-up? Messing with the displayed times people sent their comments is honestly akin to rewriting their answers.
- bitwize 3mo ago"Nothing could have prevented this from happening," say users of only language where this happens
- tangsoupgallery 3mo ago[flagged]
- pseudocoder204 3mo ago[dead]
- reorder9695 3mo agoCould this be used to unlock bootloaders on typically non unlockable phones? If so this could be one of the best things to happen to Android.
- pkoiralap 3mo agoHuge kudos to the security researchers for 1, finding an exploit, and 2, unlike copyfail, excluding a zero-day ready-to-use LPE script that anyone could have used. I tried using this for LPE on a Rocky9 for a couple of hours and thankfully couldn't get it to work. So that means unless you have quite some free time on your hand, or are extremely good at doing what you do, you can't actually use this to get LPE on enterprise distros.
- anthk 3mo agoA good think I use JS less browsers.